---
title: "Enroll verified authenticator"
method: POST
path: "/users/{userId}/authenticators"
tags: ["users"]
---

# Enroll verified authenticator

`POST /users/{userId}/authenticators`

Enroll an authenticator on behalf of a user. This operation should only be used in cases where you have already verified a user's email address or phone number in your own system.

## Path parameters

- `userId` string, required

## Request body

- object
  - `verificationMethod` 'EMAIL_MAGIC_LINK' | 'EMAIL_OTP' | 'SMS' | 'AUTHENTICATOR_APP' | 'PASSKEY' | 'WHATSAPP', required — The verification method of the authenticator being enrolled.
  - `email` string — The user's email address. Required for EMAIL_MAGIC_LINK and EMAIL_OTP.
  - `phoneNumber` string — The user's phone number in E.164 format. Required for SMS.
  - `otpUri` string — The formatted OTP URI. Required for AUTHENTICATOR_APP.
  - `oobChannel` 'EMAIL_MAGIC_LINK' | 'EMAIL_OTP' | 'SMS' — Deprecated - use 'verificationMethod' instead.
  - `credentialId` string — The passkey credential ID from the WebAuthn credential. Required for PASSKEY.
  - `credentialPublicKey` string — The passkey credential public key (base64url-encoded). Required for PASSKEY.
  - `counter` number — The signature counter from the WebAuthn authenticator. Used for PASSKEY to detect cloned credentials.
  - `name` string — A display name for the passkey authenticator (e.g. device or browser name). Used for PASSKEY.
  - `username` string — The WebAuthn username associated with the passkey (e.g. the user's email or handle shown in the browser's passkey picker). Used for PASSKEY.
  - `transports` string[] — Transport hints for the passkey (e.g. "internal", "hybrid"). Used for PASSKEY.
  - `aaguid` string — The AAGUID of the authenticator that created the passkey. Used for PASSKEY.
  - `isDefault` boolean — Whether this authenticator should be set as the user's default.

## Response `200`

OK

- object
  - `authenticator` UserAuthenticator
    - `userAuthenticatorId` string, required
    - `verificationMethod` 'SMS' | 'AUTHENTICATOR_APP' | 'EMAIL_MAGIC_LINK' | 'EMAIL_OTP' | 'PUSH' | 'DEVICE' | 'SECURITY_KEY' | 'PASSKEY' | 'VERIFF' | 'IPROOV' | 'PALM_BIOMETRICS_RR' | 'IDVERSE', required
    - `email` string
    - `phoneNumber` string
    - `username` string
    - `displayName` string
    - `createdAt` string, date-time, required
    - `verifiedAt` string, date-time
    - `lastVerifiedAt` string, date-time
    - `previousSmsChannel` 'DEFAULT' | 'WHATSAPP' — The channel that was last used by the user to complete an SMS challenge. Only defined if the verification method is SMS.
    - `webauthnCredential` object
      - `credentialId` string
      - `deviceId` string
      - `name` string — The name of the passkey. Defaults to `aaguidMapping.name` if available.
      - `aaguid` string
      - `aaguidMapping` object
        - `name` string — The name of the credential manager where the passkey is stored e.g. 'iCloud Keychain'.
        - `svgIconLight` string — A base64 encoded light variant SVG icon for the credential manager.
        - `svgIconDark` string — A base64 encoded dark variant SVG icon for the credential manager.
      - `credentialBackedUp` boolean
      - `credentialDeviceType` 'singleDevice' | 'multiDevice'
      - `authenticatorAttachment` 'cross-platform' | 'platform'
      - `parsedUserAgent` object
        - `ua` string
        - `browser` object
          - `name` string
          - `version` string
          - `major` string
        - `device` object
          - `model` string
          - `type` string
          - `vendor` string
        - `engine` object
          - `name` string
          - `version` string
        - `os` object
          - `name` string
          - `version` string
        - `cpu` object
          - `architecture` string
    - `deviceName` string — The name of the device (e.g. 'iPhone 16 Pro'). Only used for PUSH verification methods.
  - `recoveryCodes` string[]

## Other responses

- `400` — Invalid Request
- `401` — Unauthorized

---

[API](https://skmtc.net/authsignal/apis/call-connect-api.md) · [All operations](https://skmtc.net/authsignal/apis/call-connect-api/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/authsignal/call-connect-api/versions/5604d744e3ad/schema)